Hacker News new | ask | show | jobs
by kccqzy 397 days ago
This strategy has not been tried. Decades of security training has focused on credentials and objects that only exist inside a computer. And because it only exists in a computer, it is too abstract and not tactile enough for regular users to form a mental model. Yubikey is the one chance where we tie digital security to physical security and give people a clear mental model. Earlier you said that

> The best algorithms are useless if they're too complicated to use and can't fit the reality of an average user.

I agree. So get rid of needing to understand algorithms and simply require users to understand passkeys in relation to their house keys.
1 comments
godelski 397 days ago 

  > This strategy has not been tried.
Has your work never given you security training?

Have you tried to convince your friends to use messaging systems like Signal? What about PGP?

  > understand passkeys in relation to their house keys.
Except they aren't the same thing. For exactly the reasons I was discussing. How often are locksmiths helping people get into their houses? What about their cars? It's a lot more common that you think.
link
kccqzy 397 days ago
You didn't get my point. It's not the lack of security training, but the issue is that the security training focuses on intangible things like passwords, domain names, links, emails. Yubikey is the opportunity to break this model and focus on tangible and tactile things that exist in the physical world. A passkey synced using iCloud or Google account does not break that model and will continue to be less understandable for real users than Yubikeys.

There are plenty of cases where I know that people have misplaced Yubikeys. They might have a spare Yubikey. Or the equivalent to finding a locksmith is to log in with a non-passkey method. It's fine and in fact better if logging in without a passkey is considered an unusual fallback.

link
godelski 397 days ago
You're not getting my point though.

  > A passkey synced using iCloud or Google account does not break that model
Yes, yes it does. Have you seen how hard it is to recover these accounts? There's not uncommon HN posts that do get these solved, but only then by high visibility. A method most people do not have available to them.

  > Or the equivalent to finding a locksmith is to log in with a non-passkey method
Sure, it is just that the backup methods end up undermining the security key.

Both of these were mentioned in my post you originally responded to: https://news.ycombinator.com/item?id=43988957

link